NullReferenceException in Renamer

[wmjordan]

I'd got a pretty big project, which could throw an exception during protection phase:

[ERROR] Unknown error occurred.
Exception: System.NullReferenceException: Object reference not set to an instance of an object.
   at Confuser.Renamer.Analyzers.ReflectionAnalyzer.Analyze(INameService nameService, ITraceService traceService, IReadOnlyList`1 moduleDefs, MethodDef method)
   at Confuser.Renamer.AnalyzePhase.Analyze(NameService service, ConfuserContext context, ProtectionParameters parameters, IDnlibDef def, Boolean runAnalyzer)
   at Confuser.Renamer.AnalyzePhase.Execute(ConfuserContext context, ProtectionParameters parameters)
   at Confuser.Core.ProtectionPipeline.ExecuteStage(PipelineStage stage, Action`1 func, Func`1 targets, ConfuserContext context)
   at Confuser.Core.ConfuserEngine.RunPipeline(ProtectionPipeline pipeline, ConfuserContext context)
   at Confuser.Core.ConfuserEngine.RunInternal(ConfuserParameters parameters, CancellationToken token)

Such an exception did not occur on other confuser forks.

The protection rule preset is minimum, with renamer enabled.
Any renamer mode (debug, reversible, etc) can trigger this exception.

[mkaring]

This analyzer doesn't exist in any other fork of ConfuserEx. It provides improved support for reflection usage. I think I know what the error was. Please have a look at this build and see if that fixes it. If it doesn't, I'll need some more information on what is wrong.

[wmjordan]

I downloaded the new build. The same error still exists.

[ERROR] Unknown error occurred.
Exception: System.NullReferenceException: Object reference not set to an instance of an object.
   at Confuser.Renamer.Analyzers.ReflectionAnalyzer.Analyze(INameService nameService, ITraceService traceService, IReadOnlyList`1 moduleDefs, MethodDef method)
   at Confuser.Renamer.AnalyzePhase.Analyze(NameService service, ConfuserContext context, ProtectionParameters parameters, IDnlibDef def, Boolean runAnalyzer)
   at Confuser.Renamer.AnalyzePhase.Execute(ConfuserContext context, ProtectionParameters parameters)
   at Confuser.Core.ProtectionPipeline.ExecuteStage(PipelineStage stage, Action`1 func, Func`1 targets, ConfuserContext context)
   at Confuser.Core.ConfuserEngine.RunPipeline(ProtectionPipeline pipeline, ConfuserContext context)
   at Confuser.Core.ConfuserEngine.RunInternal(ConfuserParameters parameters, CancellationToken token)

[mkaring]

Could you attach the debugger to ConfuserEx (like dnspy) and see where this exception is originating from? Without any information what is going on that will be very time consuming to find.

[wmjordan]

Well, I attached the former build to dnspy and found that when the problem occured, the code firstly ran to getMember = ((TypeDef t) => t.Methods);
when instr = {IL_01D0: call System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Type[])}

I followed the code into the following place:

1. TraceArguments(Instruction instr)
2. instr.CalculateStackUsage(out push, out pop);
3. CalculateStackUsage(bool methodHasReturnValue, out int pushes, out int pops) // methodHasReturnValue = false
4. CalculateStackUsageCall(Code code, out int pushes, out int pops) // within the method, code = Call, sig = {System.Reflection.MethodInfo (System.String,System.Type[])}, method outputs pushes = 1, pops = 3
5. When it went back, it seems that trace.TraceArguments(instr) had given a wrong result, the returned value was null (I was not 100% sure, since the assembly was optimized) and the code flow popped back to the catch exception part.

The CLR for the problematic assembly was .NET Framework 4.

[mkaring]

There is a new build being created that should raise a warning in case the tracing of the method argument fail and still continue to obfuscate the assembly. The warning will mention the method that contains the problem.
I would be very interested in the source code of this specific method, for further analysis.

The new build is being created here.

[wmjordan]

With the help of the warning message produced by your new build, I'd managed to create a tiny project which reproduces the problem.

Please use the following stuff which should create [WARN] Tracing arguments for System.Reflection.MethodInfo System.Type::GetMethod(System.String,System.Type[]) call in System.Void ConsoleApp1.Program::Main(System.String[]) failed. What ever member is referenced here by reflection won't be properly handled by the name obfuscation..

The sample bin file is
ConsoleApp1.zip

	class Program
	{
		static void Main(string[] args) {
			typeof(A).GetMethod("X", new[] { GetType(1) ?? MyType.Int });
		}

		static Type GetType(object v) {
			return v.GetType();
		}
	}
	static class MyType
	{
		public static readonly Type Int = typeof(int);
	}
	class A
	{
		public void X(int a, int b) {

		}
	}

[mkaring]

I think I found the bug. Please test this build and see if the warning is gone with the actual code.

[wmjordan]

Thank you for fixing the problem.
No more error is seem. The workflow ends without problem.

However, I could not test my project which was going to be protected, since I encountered another issue (not appeared to be related to this issue) in the obfuscated assembly, which made the assembly broken. I will try to open a new issue describing the problem.